Comment by tptacek

If you believe that sshd might harbor a preauth RCE --- something that hasn't happened in a very long time --- then deploy real security in front of it: stick it on the other end of a simple encrypted tunnel.